The threat of security attacks on a control system has been increasing. A technique of detecting the attacks by monitoring logs has attracted attention, because a facility update period of the control system is long unlike that of an IT system and the risk of a system suspension due to an update is high. A representative log includes communication logs.
In a state in which a number of communication packets occur for a short time at the time of failure in a control system, which is called a multiple state change, a number of communication logs are transmitted. Therefore, there have been cases in which when a number of communication logs are generated for a short time, a network band and a server load increase, thereby causing a transmission delay of a communication packet and the loss of a communication packet and a communication log.